Hackers exploit macOS Screen Sharing flaw to deploy Monero miner

Macs Under Siege: Active Exploitation of Screen Sharing Flaw Hands Attackers Root Access

Dutch authorities sounded an urgent alarm this week. A vulnerability in macOS Screen Sharing has fallen into the hands of attackers who waste no time turning exposed machines into crypto mining rigs. The flaw, now identified as CVE-2026-65400, lets remote adversaries bypass authentication entirely and seize full control. No password required. Just an open port. Apple shipped fixes on August 6. Yet the Ars Technica report makes clear that exploit…

Vulnerability giving attackers full control of Macs is under active exploitation

Dutch officials have warned that a high-severity macOS vulnerability that allows attackers to execute malicious code is under active exploitation. “The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet,” the Netherlands National Cyber Security Centrum warned earlier this week. “In all these cases, root had been accessed on …

Hackers exploit macOS Screen Sharing flaw to deploy Monero miner

The Netherlands' National Cyber Security Centre (NCSC) is warning that hackers are actively exploiting a macOS authentication bypass vulnerability after public exploit code emerged. [...]

Alarming Zero-Day Mac Attack Gives Hackers Full System Control, Active Exploit

The National Cyber Security Centrum (NCSC) of the Netherlands says it has evidence that hackers are actively exploiting a vulnerability in one of macOS’ sharing features, which can provide attackers with complete access over a victim’s computer. This flaw was discovered across several macOS releases, including Tahoe, Sequoia and Sonoma. The

Critical macOS Screen Sharing flaw gives attackers remote root access — CISA bumps bug to 9.8 severity following active Monero cryptojacking attacks

The Dutch National Cyber Security Centre (NCSC-NL) reported on August 12 that attackers are actively exploiting CVE-2026-65400, an authentication bypass in macOS Screen Sharing, to compromise Macs with port 5900 exposed to the Internet. In every case reported to the agency, attackers obtained root access and installed a Monero cryptocurrency miner. Apple patched the flaw on August 6 in an out-of-band update covering macOS Tahoe 26.6.1, Sequoia 1…